Microsoft-Windows-Application-Experience

Event	Title	Channel	Sample	Rule
50	PCA was requested to refresh the program cache.	Analytic	N	N
51	PCA was informed that the program cache was refreshed.	Analytic	N	N
60	PCA dialog button response ChainId.	Analytic	N	N
70	PCA triggered SIUF question was asked.	Analytic	N	N
71	task_071	Analytic	N	N
72	task_072	Analytic	N	N
73	task_073	Analytic	N	N
74	task_074	Analytic	N	N
75	task_075	Analytic	N	N
76	task_076	Analytic	N	N
77	task_077	Analytic	N	N
78	task_078	Analytic	N	N
79	task_079	Analytic	N	N
80	task_080	Analytic	N	N
81	PCA triggered SIUF question was answered.	Analytic	N	N
100	The Program Compatibility Assistant was invoked to correct a compatibility …	Program-Compatibility-Assistant	N	N
101	The Program Compatibility Assistant was invoked to correct a compatibility …	Program-Compatibility-Assistant	N	N
102	The Program Compatibility Assistant was invoked due to an unsigned driver …	Program-Compatibility-Assistant	N	N
103	The Program Compatibility Assistant was not invoked because the application has …	Program-Compatibility-Assistant	N	N
104	The Program Compatibility Assistant was not invoked as the application executed …	Program-Compatibility-Assistant	N	N
105	The Program Compatibility Assistant was invoked to correct a compatibility …	Program-Compatibility-Assistant	N	N
201	Event ID 201	System	Y	N
206	Event ID 206	System	Y	N
207	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
208	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
209	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
210	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
211	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
212	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
213	The Program Compatibility Assistant has added ExecutablePath to quarantine.	Program-Compatibility-Assistant	N	N
214	The Program Compatibility Assistant has removed ExecutablePath from quarantine.	Program-Compatibility-Assistant	N	N
215	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
300	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
301	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
302	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
303	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
304	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
305	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
306	The Program Compatibility Assistant was requested to monitor ExecutablePath, but …	Program-Compatibility-Assistant	N	N
400	The Program Compatibility Assistant attempted to connect an event for process ID …	Program-Compatibility-Assistant	N	N
500	Compatibility fix applied to CompatibilityFixEvent.ExePath.	Program-Telemetry	Y	N
501	Compatibility fix applied to Flags.	Operational	Y	N
502	Compatibility fix applied to PackageCode.	Program-Telemetry	N	N
503	Compatibility fix applied to PackageCode.	Operational	N	N
504	PCA was informed about fix FixName applied to process.	Analytic	N	N
505	Compatibility fix applied to CompatibilityFixEvent.ExePath.	Program-Telemetry	Y	N
600	An instance of the Steps Recorder ran with the following information.	Steps-Recorder	N	N
601	An instance of the Steps Recorder terminated with the following error code: …	Steps-Recorder	N	N
700	The Application Impact Telemetry (AIT) Agent terminated with the following error …	Program-Telemetry	N	N
701	The Application Impact Telemetry (AIT) Agent is not running because AIT is …	Program-Telemetry	N	N
702	The Application Impact Telemetry (AIT) Agent is stopping because another …	Program-Telemetry	N	N
703	The Application Impact Telemetry (AIT) Agent was unable to parse the …	Program-Telemetry	N	N
704	The Application Impact Telemetry (AIT) Agent was unable to process the logs …	Program-Telemetry	N	N
705	The Application Impact Telemetry (AIT) Agent was unable to start application …	Program-Telemetry	N	N
706	The Application Impact Telemetry (AIT) Agent was unable to log application …	Program-Telemetry	N	N
707	The Application Impact Telemetry (AIT) Agent was unable to start system …	Program-Telemetry	N	N
708	The Application Impact Telemetry (AIT) Agent was unable to log system telemetry …	Program-Telemetry	N	N
800	An instance of Program Data Updater (PDU) ran with the following information: …	Program-Inventory	N	N
900	An Internet Explorer add-on was installed on the system.	Program-Inventory	N	N
901	An Internet Explorer add-on was updated on the system.	Program-Inventory	N	N
902	An Internet Explorer add-on was removed from the system.	Program-Inventory	N	N
903	A program was installed on the system.	Program-Inventory	N	N
904	A program was installed on the system.	Program-Inventory	N	N
905	A program was updated on the system.	Program-Inventory	N	N
906	A program was updated on the system.	Program-Inventory	N	N
907	A program was removed from the system.	Program-Inventory	N	N
908	A program was removed from the system.	Program-Inventory	N	N
909	AMI cache update failure.	Compatibility-Infrastructure-Debug	N	N
910	task_0910	Operational	N	N
911	task_0911	Operational	N	N
1003	Installer cancel click detected.	Analytic	N	N
1004	InstallerShield detected.	Analytic	N	N
1005	File installed.	Analytic	N	N
1006	New arp key.	Analytic	N	N
1100	DirectX detection: HighDPIAware.	Analytic	N	N
1101	DirectX detection: MaximizedWindowedMode.	Analytic	N	N
1102	DirectX detection: AdaptWindowToDisplayMode.	Analytic	N	N
2001	The Application Impact Telemetry (AIT) Static Analysis tool ran with the …	Program-Telemetry	N	N
2002	ErrorMessage.	Compatibility-Infrastructure-Debug	N	N
2003	The Application Impact Telemetry (AIT) Static Analysis tool ran with the …	Program-Telemetry	N	N
2005	QuirkName.	Operational	Y	N
5001	The Program Compatibility Troubleshooter was invoked to correct a compatibility …	Program-Compatibility-Troubleshooter	N	N
5002	The Program Compatibility Troubleshooter queried the Compatibility Online …	Program-Compatibility-Troubleshooter	N	N
5003	The Program Compatibility Troubleshooter queried the application genome for …	Program-Compatibility-Troubleshooter	N	N
5004	Program Compatibility Troubleshooter debug event.	Program-Compatibility-Troubleshooter	N	N
8000	Detector shim: SHORT_RUN_TIME.	Analytic	N	N
8001	Detector shim: ACCESS_DENIED.	Analytic	N	N
8002	Detector shim: BLACK_SCREEN.	Analytic	N	N
8003	Detector shim: WIN32_EXCEPTION: ExtraDataSize.	Analytic	N	N
8004	Detector shim: GLOBAL_OBJECT.	Analytic	N	N
8005	Detector shim: PRIVILEGE_CHECK.	Analytic	N	N
8006	Detector shim: MESSAGE_BOX_VERSION.	Analytic	N	N
8007	Detector shim: MESSAGE_BOX_PRIVILEGE.	Analytic	N	N
8008	Detector shim: MESSAGE_BOX_ERROR_ICON.	Analytic	N	N
8010	Detector shim: REG_EXPAND_SZ.	Analytic	N	N
8011	Detector shim: DWM_8AND16_MODE.	Analytic	N	N
8012	Detector shim: KERNEL_DRIVER.	Analytic	N	N
16000	task_016000	Operational	N	N
16001	task_016001	Operational	N	N
16002	task_016002	Operational	N	N
16003	task_016003	Operational	N	N
16010	task_016010	Operational	N	N
16011	task_016011	Operational	N	N
16012	task_016012	Operational	N	N
16100	task_016100	Operational	N	N
16101	task_016101	Operational	N	N
16102	task_016102	Operational	N	N
16103	task_016103	Operational	N	N
16110	task_016110	Operational	N	N
16111	task_016111	Operational	N	N
16112	task_016112	Operational	N	N
16113	task_016113	Operational	N	N
32764	Message.	Compatibility-Infrastructure-Debug	N	N
32765	Chain: Chain, Process: Process, Type: Type.	Trace	Y	N
32766	Message.	Analytic	N	N
32767	Message.	Compatibility-Infrastructure-Debug	N	N

Event ID 50: PCA was requested to refresh the program cache.

Channel: Analytic

Event ID 51: PCA was informed that the program cache was refreshed.

Channel: Analytic

Event ID 60: PCA dialog button response ChainId.

Channel: Analytic

Message #

PCA dialog button response %2.

Fields #

Name	Description
`DialogGuid` GUID
`ChainId` UInt32
`ButtonId` UInt32

Event ID 70: PCA triggered SIUF question was asked.

Channel: Analytic

Fields #

Name	Description
`QuestionId` GUID
`QuestionText` UnicodeString

Event ID 71: task_071

Channel: Analytic

Event ID 72: task_072

Channel: Analytic

Event ID 73: task_073

Channel: Analytic

Event ID 74: task_074

Channel: Analytic

Event ID 75: task_075

Channel: Analytic

Event ID 76: task_076

Channel: Analytic

Event ID 77: task_077

Channel: Analytic

Event ID 78: task_078

Channel: Analytic

Event ID 79: task_079

Channel: Analytic

Event ID 80: task_080

Channel: Analytic

Event ID 81: PCA triggered SIUF question was answered.

Channel: Analytic

Fields #

Name	Description
`QuestionId` GUID
`QuestionKind` UnicodeString
`QuestionValue` UInt32
`FollowupValue` UnicodeString

Event ID 100: The Program Compatibility Assistant was invoked to correct a compatibility problem.

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Message #

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
User action ID: %6
Compatibility layer: %7
FileID: %8
ProgramID: %9

Fields #

Name	Description
`ApplicationName` UnicodeString
`ApplicationVersion` UnicodeString
`ExecutablePath` UnicodeString
`ScenarioId` UnicodeString
`UserAction` UnicodeString
`UserActionID` UnicodeString
`CompatibilityLayer` UnicodeString
`FileID` UnicodeString
`ProgramID` UnicodeString

Event ID 101: The Program Compatibility Assistant was invoked to correct a compatibility problem.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.Application name: {ApplicationName}Application version: {ApplicationVersion}Executable path: {ExecutablePath}Scenario ID: {ScenarioId}User action: {UserAction}User action ID: {UserActionID}Compatibility layer: {CompatibilityLayer}Deprecated component: {DeprecatedComponent}FileID: {FileID}ProgramID: {ApplicationName}0

Fields #

Name	Description
`ApplicationName`
`ApplicationVersion`
`ExecutablePath`
`ScenarioId`
`UserAction`
`UserActionID`
`CompatibilityLayer`
`DeprecatedComponent`
`FileID`

Event ID 102: The Program Compatibility Assistant was invoked due to an unsigned driver install.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was invoked due to an unsigned driver install. This version of Windows requires all drivers to have a valid digital signature. Information about the driver is below.Driver: {DriverName}Service: {ServiceName}Publisher: {PublisherName}Location: {DriverPath}Version: {DriverVersion}This driver is unavailable and the program that uses this driver might not work correctly.

Fields #

Name	Description
`DriverName`
`ServiceName`
`PublisherName`
`DriverPath`
`DriverVersion`

Event ID 103: The Program Compatibility Assistant was not invoked because the application has been already handled previously.

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was not invoked because the application has been already handled previously. Information about the application is below.

Message #

The Program Compatibility Assistant was not invoked because the application has been already handled previously. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
Compatibility layer: %6

Fields #

Name	Description
`ApplicationName` UnicodeString
`ApplicationVersion` UnicodeString
`ExecutablePath` UnicodeString
`ScenarioId` UnicodeString
`UserAction` UnicodeString
`UserActionID` UnicodeString
`CompatibilityLayer` UnicodeString
`FileID` UnicodeString
`ProgramID` UnicodeString

Event ID 104: The Program Compatibility Assistant was not invoked as the application executed correctly.

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was not invoked as the application executed correctly. Information about the application is below.

Message #

The Program Compatibility Assistant was not invoked as the application executed correctly. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
Compatibility layer: %6

Fields #

Name	Description
`ApplicationName` UnicodeString
`ApplicationVersion` UnicodeString
`ExecutablePath` UnicodeString
`ScenarioId` UnicodeString
`UserAction` UnicodeString
`UserActionID` UnicodeString
`CompatibilityLayer` UnicodeString
`FileID` UnicodeString
`ProgramID` UnicodeString

Event ID 105: The Program Compatibility Assistant was invoked to correct a compatibility problem.

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Message #

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenarios code: %4
Deprecated Components: %5
User action ID: %6
Compatibility layers recommended: %7
FileID: %8
ProgramID: %9

Fields #

Name	Description
`ApplicationName` UnicodeString
`ApplicationVersion` UnicodeString
`ExecutablePath` UnicodeString
`ScenarioId` UnicodeString
`UserAction` UnicodeString
`UserActionID` UnicodeString
`CompatibilityLayer` UnicodeString
`FileID` UnicodeString
`ProgramID` UnicodeString

Event ID 201

Channel: System
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application-Experience",
    "guid": "EEF54E71-0661-422D-9A98-82FD4940B820",
    "event_source_name": "",
    "event_id": 201,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2013-10-23T16:24:25.239375Z",
    "event_record_id": 380,
    "correlation": {},
    "execution": {
      "process_id": 892,
      "thread_id": 3532
    },
    "channel": "System",
    "computer": "IE8Win7",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 206

Channel: System
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application-Experience",
    "guid": "EEF54E71-0661-422D-9A98-82FD4940B820",
    "event_source_name": "",
    "event_id": 206,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2013-10-23T22:03:32.528125Z",
    "event_record_id": 2787,
    "correlation": {},
    "execution": {
      "process_id": 808,
      "thread_id": 2792
    },
    "channel": "System",
    "computer": "IE8Win7",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 207: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application is excluded in the registry.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application is excluded in the registry.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 208: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because of the extension of the executable.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because of the extension of the executable.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 209: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the executable has a UAC manifest.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the executable has a UAC manifest.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 210: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application has a compatibility fix applied to...

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application has a compatibility fix applied to it.

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application has a compatibility fix applied to it.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 211: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application depends on the Windows Installer s...

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application depends on the Windows Installer service (MSI).

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application depends on the Windows Installer service (MSI).

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 212: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the executable has a current SwitchBack context.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the executable has a current SwitchBack context.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 213: The Program Compatibility Assistant has added ExecutablePath to quarantine.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant has added %1 to quarantine.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 214: The Program Compatibility Assistant has removed ExecutablePath from quarantine.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant has removed %1 from quarantine.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 215: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the executable has a UAC manifest.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the executable has a UAC manifest.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 300: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the PCA is disabled by group policy.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the PCA is disabled by group policy.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 301: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application already exists within a job object.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application already exists within a job object.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 302: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application is a 64-bit application.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application is a 64-bit application.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 303: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application is on a network path.

Channel: Program-Compatibility-Assistant

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application is on a network path.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 304: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application compatibility infrastructure is di...

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application compatibility infrastructure is disabled.

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application compatibility infrastructure is disabled.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 305: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application is protected by Windows Resource P...

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application is protected by Windows Resource Protection.

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application is protected by Windows Resource Protection.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 306: The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application has been excluded from the PCA by ...

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was requested to monitor ExecutablePath, but ignored the request because the application has been excluded from the PCA by Microsoft.

Message #

The Program Compatibility Assistant was requested to monitor %1, but ignored the request because the application has been excluded from the PCA by Microsoft.

Fields #

Name	Description
`ExecutablePath` UnicodeString

Event ID 400: The Program Compatibility Assistant attempted to connect an event for process ID ProcessId, but the Program Compatibility Assistant service was unable to ...

Channel: Program-Compatibility-Assistant

Description

The Program Compatibility Assistant attempted to connect an event for process ID ProcessId, but the Program Compatibility Assistant service was unable to locate the process.

Message #

The Program Compatibility Assistant attempted to connect an event for process ID %1, but the Program Compatibility Assistant service was unable to locate the process.

Fields #

Name	Description
`ProcessId` UInt32

Event ID 500: Compatibility fix applied to CompatibilityFixEvent.ExePath.

Channel: Program-Telemetry
Level: Informational

Message #

Compatibility fix applied to %5.
Fix information: %6, %3, %4.

Fields #

Name	Description
`ProcessId`
`StartTime`
`FixID`
`Flags`
`ExePath`
`FixName`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application-Experience",
    "guid": "EEF54E71-0661-422D-9A98-82FD4940B820",
    "event_source_name": "",
    "event_id": 500,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423488,
    "time_created": "2023-11-06T02:01:06.316061+00:00",
    "event_record_id": 268,
    "correlation": {},
    "execution": {
      "process_id": 10532,
      "thread_id": 16892
    },
    "channel": "Microsoft-Windows-Application-Experience/Program-Telemetry",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "user_data": {
    "CompatibilityFixEvent": {
      "ProcessId": 10532,
      "StartTime": 1699236066.0862,
      "FixID": "AD24F32A-1C4D-4D71-AF4E-1D9031C04F14",
      "Flags": 65793,
      "ExePath": "C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.bin",
      "FixName": "Apache OpenOffice"
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 501: Compatibility fix applied to Flags.

Channel: Operational
Level: Informational

Message #

Compatibility fix applied to %5.
Fix information: %6, %3, %4.

Fields #

Name	Description
`ProcessId` UInt32
`StartTime` FILETIME
`FixID` GUID
`Flags` HexInt32
`ExePath` UnicodeString
`FixName` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Application-Experience/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 501,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9304,
      "thread_id": 2016
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Application-Experience",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:52:00.210Z",
    "version": 0
  },
  "event_data": {
    "ExePath": "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
    "FixID": "{ABFFD2A7-69ED-49F5-9A32-2855803366C3}",
    "FixName": "Update",
    "Flags": "01010104",
    "ProcessId": 9304,
    "StartTime": "2026-07-22 01:52:00.134Z"
  },
  "message": ""
}

Event ID 502: Compatibility fix applied to PackageCode.

Channel: Program-Telemetry

Message #

Compatibility fix applied to %7.
Fix information: %8, %3, %4.

Fields #

Name	Description
`ClientProcessId` UInt32
`ClientStartTime` FILETIME
`FixID` GUID
`Flags` HexInt32
`ProductCode` GUID
`PackageCode` GUID
`MsiPath` UnicodeString
`FixName` UnicodeString

Event ID 503: Compatibility fix applied to PackageCode.

Channel: Operational

Message #

Compatibility fix applied to %7.
Fix information: %8, %3, %4.

Fields #

Name	Description
`ClientProcessId` UInt32
`ClientStartTime` FILETIME
`FixID` GUID
`Flags` HexInt32
`ProductCode` GUID
`PackageCode` GUID
`MsiPath` UnicodeString
`FixName` UnicodeString

Event ID 504: PCA was informed about fix FixName applied to process.

Channel: Analytic

Message #

PCA was informed about fix %2 applied to process.

Fields #

Name	Description
`FixNameLength` UInt32
`FixName` UnicodeString
`FixType` UInt32

Event ID 505: Compatibility fix applied to CompatibilityFixEvent.ExePath.

Channel: Program-Telemetry
Level: Informational

Message #

Compatibility fix applied to %5.
Fix information: %6, %3, %4.

Fields #

Name	Description
`ProcessId`
`StartTime`
`FixID`
`Flags`
`ExePath`
`FixName`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application-Experience",
    "guid": "EEF54E71-0661-422D-9A98-82FD4940B820",
    "event_source_name": "",
    "event_id": 505,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 576460752303423488,
    "time_created": "2023-11-06T01:51:42.489178+00:00",
    "event_record_id": 265,
    "correlation": {},
    "execution": {
      "process_id": 21364,
      "thread_id": 8156
    },
    "channel": "Microsoft-Windows-Application-Experience/Program-Telemetry",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "user_data": {
    "CompatibilityFixEvent": {
      "ProcessId": 21364,
      "StartTime": 1699235502.3153903,
      "FixID": "6F36AB95-595F-497D-9001-86DAD299B6FA",
      "Flags": 2147549701,
      "ExePath": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "FixName": "AppDefaults"
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 600: An instance of the Steps Recorder ran with the following information.

Channel: Steps-Recorder

Message #

An instance of the Steps Recorder ran with the following information:

StartTime: %1
StopTime: %2
Action Count: %3
Missed Action Count: %4
Output file location: %5

Fields #

Name	Description
`StartTime` FILETIME	[An instance of the Steps Recorder ran with the following information] StartTime.
`StopTime` FILETIME	[An instance of the Steps Recorder ran with the following information] StopTime.
`ActionCount` UInt32
`MissedActionCount` UInt32
`OutputFileLocation` UnicodeString

Event ID 601: An instance of the Steps Recorder terminated with the following error code: ErrorCode.

Channel: Steps-Recorder

Message #

An instance of the Steps Recorder terminated with the following error code: %1

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 700: The Application Impact Telemetry (AIT) Agent terminated with the following error code: FailureCode.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Agent terminated with the following error code: %1

Fields #

Name	Description
`FailureCode` HexInt32	NTSTATUS reference

Event ID 701: The Application Impact Telemetry (AIT) Agent is not running because AIT is disabled.

Channel: Program-Telemetry

Event ID 702: The Application Impact Telemetry (AIT) Agent is stopping because another instance is already running.

Channel: Program-Telemetry

Event ID 703: The Application Impact Telemetry (AIT) Agent was unable to parse the command-line options with error code: FailureCode.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Agent was unable to parse the command-line options with error code: %1.

Fields #

Name	Description
`FailureCode` HexInt32	NTSTATUS reference

Event ID 704: The Application Impact Telemetry (AIT) Agent was unable to process the logs files with error code: FailureCode.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Agent was unable to process the logs files with error code: %1.

Fields #

Name	Description
`FailureCode` HexInt32	NTSTATUS reference

Event ID 705: The Application Impact Telemetry (AIT) Agent was unable to start application impact SQM with error code: FailureCode.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Agent was unable to start application impact SQM with error code: %1.

Fields #

Name	Description
`FailureCode` HexInt32	NTSTATUS reference

Event ID 706: The Application Impact Telemetry (AIT) Agent was unable to log application impact data to SQM with error code: FailureCode.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Agent was unable to log application impact data to SQM with error code: %1.

Fields #

Name	Description
`FailureCode` HexInt32	NTSTATUS reference

Event ID 707: The Application Impact Telemetry (AIT) Agent was unable to start system telemetry with error code: FailureCode.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Agent was unable to start system telemetry with error code: %1.

Fields #

Name	Description
`FailureCode` HexInt32	NTSTATUS reference

Event ID 708: The Application Impact Telemetry (AIT) Agent was unable to log system telemetry data to SQM with error code: FailureCode.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Agent was unable to log system telemetry data to SQM with error code: %1.

Fields #

Name	Description
`FailureCode` HexInt32	NTSTATUS reference

Event ID 800: An instance of Program Data Updater (PDU) ran with the following information: StartTime: {StartTime}; StopTime: {StopTime}; ExitCode: {ExitCode}; N...

Channel: Program-Inventory

Message #

An instance of Program Data Updater (PDU) ran with the following information: StartTime: {StartTime}; StopTime: {StopTime}; ExitCode: {ExitCode}; Number of new programs: {NumNewPrograms}; Number of removed programs: {NumRemovedPrograms}; Number of updated programs: {NumUpdatedPrograms}; Number of installed programs: {NumInstalledPrograms}; Number of new orphan files: {NumNewOrphans}; Number of new add-ons: {NumNewAddOns}; Number of removed add-ons: {StartTime}0; Number of updated add-ons: {StartTime}1; Number of installed add-ons: {StartTime}2; Number of new installations: {StartTime}3

Fields #

Name	Description
`StartTime`
`StopTime`
`ExitCode`
`NumNewPrograms`
`NumRemovedPrograms`
`NumUpdatedPrograms`
`NumInstalledPrograms`
`NumNewOrphans`
`NumNewAddOns`

Event ID 900: An Internet Explorer add-on was installed on the system.

Channel: Program-Inventory

Description

An Internet Explorer add-on was installed on the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}.

Message #

An Internet Explorer add-on was installed on the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}

Fields #

Name	Description
`Name`
`Type`
`Publisher`
`CLSID`

Event ID 901: An Internet Explorer add-on was updated on the system.

Channel: Program-Inventory

Description

An Internet Explorer add-on was updated on the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}.

Message #

An Internet Explorer add-on was updated on the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}

Fields #

Name	Description
`Name`
`Type`
`Publisher`
`CLSID`

Event ID 902: An Internet Explorer add-on was removed from the system.

Channel: Program-Inventory

Description

An Internet Explorer add-on was removed from the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}.

Message #

An Internet Explorer add-on was removed from the system. For details; please examine the event data.Name: {Name}Type: {Type}Publisher: {Publisher}CLSID: {CLSID}

Fields #

Name	Description
`Name`
`Type`
`Publisher`
`CLSID`

Event ID 903: A program was installed on the system.

Channel: Program-Inventory
Collection Priority: Recommended (NSA)

Description

A program was installed on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}.

Message #

A program was installed on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields #

Name	Description
`Name`
`Version`
`Publisher`

Event ID 904: A program was installed on the system.

Channel: Program-Inventory
Collection Priority: Recommended (NSA)

Description

A program was installed on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}.

Message #

A program was installed on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields #

Name	Description
`Name`
`Version`
`Publisher`

Event ID 905: A program was updated on the system.

Channel: Program-Inventory
Collection Priority: Recommended (NSA)

Description

A program was updated on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}.

Message #

A program was updated on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields #

Name	Description
`Name`
`Version`
`Publisher`

Event ID 906: A program was updated on the system.

Channel: Program-Inventory
Collection Priority: Recommended (NSA)

Description

A program was updated on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}.

Message #

A program was updated on the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields #

Name	Description
`Name`
`Version`
`Publisher`

Event ID 907: A program was removed from the system.

Channel: Program-Inventory
Collection Priority: Recommended (NSA)

Description

A program was removed from the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}.

Message #

A program was removed from the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields #

Name	Description
`Name`
`Version`
`Publisher`

Event ID 908: A program was removed from the system.

Channel: Program-Inventory
Collection Priority: Recommended (NSA)

Description

A program was removed from the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}.

Message #

A program was removed from the system. For details; please examine the event data.Name: {Name}Version: {Version}Publisher: {Publisher}

Fields #

Name	Description
`Name`
`Version`
`Publisher`

Event ID 909: AMI cache update failure.

Channel: Compatibility-Infrastructure-Debug

Description

AMI cache update failure.File path: {FilePath}File ID: {FileID}Program ID: {ProgramID}Error Code: {ErrorCode}.

Message #

AMI cache update failure.File path: {FilePath}File ID: {FileID}Program ID: {ProgramID}Error Code: {ErrorCode}

Fields #

Name	Description
`FilePath`
`FileID`
`ProgramID`
`ErrorCode`

Event ID 910: task_0910

Channel: Operational

Fields #

Name	Description
`ProgramID` UnicodeString
`Name` UnicodeString
`Publisher` UnicodeString
`Version` UnicodeString
`Language` UnicodeString
`ProgramType` UnicodeString

Event ID 911: task_0911

Channel: Operational

Fields #

Name	Description
`ProgramID` UnicodeString
`FilePath` UnicodeString

Event ID 1003: Installer cancel click detected.

Channel: Analytic

Fields #

Name	Description
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 1004: InstallerShield detected.

Channel: Analytic

Fields #

Name	Description
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 1005: File installed.

Channel: Analytic

Fields #

Name	Description
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 1006: New arp key.

Channel: Analytic

Fields #

Name	Description
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 1100: DirectX detection: HighDPIAware.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 1101: DirectX detection: MaximizedWindowedMode.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 1102: DirectX detection: AdaptWindowToDisplayMode.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 2001: The Application Impact Telemetry (AIT) Static Analysis tool ran with the following results.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Static Analysis tool ran with the following results:

Start time: %7
Stop time: %8
Runtime: %9
Exit code: %3
Type of analysis: %4
Number of files analyzed: %5
Number of files failed: %6
Analysis command: %10
Program ID: %11

Fields #

Name	Description
`cchIdAnalyzedIncludingNull` UInt16
`cchProgramIdIncludingNull` UInt16
`ExitCode` UInt32
`IdTypeAnalyzed` UInt32
`NumFilesAnalyzed` UInt32
`NumFilesFailed` UInt32
`StartTime` FILETIME
`StopTime` FILETIME
`RunTime` UInt64
`IdAnalyzed` UnicodeString
`ProgramId` UnicodeString

Event ID 2002: ErrorMessage.

Channel: Compatibility-Infrastructure-Debug

Message #

%1

Fields #

Name	Description
`ErrorMessage` AnsiString

Event ID 2003: The Application Impact Telemetry (AIT) Static Analysis tool ran with the following results.

Channel: Program-Telemetry

Message #

The Application Impact Telemetry (AIT) Static Analysis tool ran with the following results:

Start time: %7
Stop time: %8
Runtime: %9
Exit code: %3
Type of analysis: %4
Number of files analyzed: %5
Number of files failed: %6
Analysis command: %10
Program ID: %11

Fields #

Name	Description
`cchIdAnalyzedIncludingNull` UInt16
`cchProgramIdIncludingNull` UInt16
`ExitCode` UInt32
`IdTypeAnalyzed` UInt32
`NumFilesAnalyzed` UInt32
`NumFilesFailed` UInt32
`StartTime` FILETIME
`StopTime` FILETIME
`RunTime` UInt64
`IdAnalyzed` UnicodeString
`ProgramId` UnicodeString

Event ID 2005: QuirkName.

Channel: Operational
Also via: realtime ETW trace
Level: Informational

Message #

%3

Fields #

Name	Description
`ProcessId` UInt32
`QuirkId` UInt32
`QuirkName` UnicodeString
`CommandLine` UnicodeString
`Enabled` UInt8
`Forced` UInt8
`PackageFullName` UnicodeString
`ApplicationUserModelId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application-Experience",
    "guid": "{EEF54E71-0661-422D-9A98-82FD4940B820}",
    "event_source_name": "",
    "event_id": 2005,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000200",
    "time_created": "2026-06-02T05:07:41.969+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 17560,
      "thread_id": 20192
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ApplicationUserModelId": "",
    "CommandLine": "",
    "Enabled": 0,
    "Forced": 0,
    "PackageFullName": "",
    "ProcessId": 17560,
    "QuirkId": 196608,
    "QuirkName": "WRL.PropagateErrorsFromDelegates"
  },
  "message": ""
}

Event ID 5001: The Program Compatibility Troubleshooter was invoked to correct a compatibility problem.

Channel: Program-Compatibility-Troubleshooter

Description

The Program Compatibility Troubleshooter was invoked to correct a compatibility problem. Information about the application is below.

Message #

The Program Compatibility Troubleshooter was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
Result: %5
Result ID: %6
Compatibility layer: %7
FileID: %8
ProgramID: %9

Fields #

Name	Description
`ApplicationName` UnicodeString
`ApplicationVersion` UnicodeString
`ExecutablePath` UnicodeString
`ScenarioId` UnicodeString
`Result` UnicodeString
`ResultID` UnicodeString
`CompatibilityLayer` UnicodeString
`FileID` UnicodeString
`ProgramID` UnicodeString

Event ID 5002: The Program Compatibility Troubleshooter queried the Compatibility Online Service for information about an application.

Channel: Program-Compatibility-Troubleshooter

Description

The Program Compatibility Troubleshooter queried the Compatibility Online Service for information about an application. Results are below.

Message #

The Program Compatibility Troubleshooter queried the Compatibility Online Service for information about an application. Results are below.

Application name: %1
Application version: %2
Executable path: %3
Recommended layer: %4
URL: %5
Compatibility status: %6
FileID: %7
ProgramID: %8

Fields #

Name	Description
`ApplicationName` UnicodeString
`ApplicationVersion` UnicodeString
`ExecutablePath` UnicodeString
`RecommendedLayer` UnicodeString
`URL` UnicodeString
`CompatStatus` UInt32
`FileID` UnicodeString
`ProgramID` UnicodeString

Event ID 5003: The Program Compatibility Troubleshooter queried the application genome for information about an application.

Channel: Program-Compatibility-Troubleshooter

Description

The Program Compatibility Troubleshooter queried the application genome for information about an application. Results are below.

Message #

The Program Compatibility Troubleshooter queried the application genome for information about an application. Results are below.

Application name: %1
Application version: %2
Executable path: %3
Recommended layer: %4
Vista+: %5
FileID: %6
ProgramID: %7

Fields #

Name	Description
`ApplicationName` UnicodeString
`ApplicationVersion` UnicodeString
`ExecutablePath` UnicodeString
`RecommendedLayer` UnicodeString
`VistaPlus` UInt32
`FileID` UnicodeString
`ProgramID` UnicodeString

Event ID 5004: Program Compatibility Troubleshooter debug event.

Channel: Program-Compatibility-Troubleshooter

Message #

Program Compatibility Troubleshooter debug event:
%1
%2

Fields #

Name	Description
`DebugString` UnicodeString
`qwData` UInt64

Event ID 8000: Detector shim: SHORT_RUN_TIME.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8001: Detector shim: ACCESS_DENIED.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8002: Detector shim: BLACK_SCREEN.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8003: Detector shim: WIN32_EXCEPTION: ExtraDataSize.

Channel: Analytic

Message #

Detector shim: WIN32_EXCEPTION: %3.

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8004: Detector shim: GLOBAL_OBJECT.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8005: Detector shim: PRIVILEGE_CHECK.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8006: Detector shim: MESSAGE_BOX_VERSION.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8007: Detector shim: MESSAGE_BOX_PRIVILEGE.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8008: Detector shim: MESSAGE_BOX_ERROR_ICON.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8010: Detector shim: REG_EXPAND_SZ.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8011: Detector shim: DWM_8AND16_MODE.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 8012: Detector shim: KERNEL_DRIVER.

Channel: Analytic

Fields #

Name	Description
`Flags` UInt32
`ExtraDataSize` UInt32
`ExtraData` Binary

Event ID 16000: task_016000

Channel: Operational

Fields #

Name	Description
`Name` UnicodeString
`CommandLine` UnicodeString
`RoutingMode` UnicodeString
`Class` UnicodeString
`HostDll` UnicodeString
`InExMode` UnicodeString
`InExIncludes` UnicodeString
`InExExcludes` UnicodeString

Event ID 16001: task_016001

Channel: Operational

Fields #

Name	Description
`Name` UnicodeString
`Type` UnicodeString

Event ID 16002: task_016002

Channel: Operational

Fields #

Name	Description
`Name` UnicodeString

Event ID 16003: task_016003

Channel: Operational

Fields #

Name	Description
`Name` UnicodeString
`CommandLine` UnicodeString
`Enabled` Boolean

Event ID 16010: task_016010

Channel: Operational

Fields #

Name	Description
`ModuleToHook` UnicodeString
`HookModule` AnsiString
`HookApi` AnsiString
`Hooked` Boolean
`Reason` UnicodeString

Event ID 16011: task_016011

Channel: Operational

Fields #

Name	Description
`Name` UnicodeString
`Patched` Boolean
`Reason` UnicodeString

Event ID 16012: task_016012

Channel: Operational

Fields #

Name	Description
`Class` UnicodeString
`Interface` UnicodeString
`ApiIndex` UInt32
`Hooked` Boolean
`Reason` UnicodeString

Event ID 16100: task_016100

Channel: Operational

Fields #

Name	Description
`ShimName` AnsiString
`Message` AnsiString

Event ID 16101: task_016101

Channel: Operational

Fields #

Name	Description
`ShimName` AnsiString
`Message` AnsiString

Event ID 16102: task_016102

Channel: Operational

Fields #

Name	Description
`ShimName` AnsiString
`Message` AnsiString

Event ID 16103: task_016103

Channel: Operational

Fields #

Name	Description
`ShimName` AnsiString
`Message` AnsiString

Event ID 16110: task_016110

Channel: Operational

Fields #

Name	Description
`ShimName` AnsiString
`ModuleName` AnsiString
`ApiName` AnsiString
`Info` AnsiString

Event ID 16111: task_016111

Channel: Operational

Fields #

Name	Description
`ShimName` AnsiString
`ModuleName` AnsiString
`ApiName` AnsiString
`Info` AnsiString

Event ID 16112: task_016112

Channel: Operational

Fields #

Name	Description
`ShimName` AnsiString
`ModuleName` AnsiString
`ApiName` AnsiString
`Info` AnsiString

Event ID 16113: task_016113

Channel: Operational

Fields #

Name	Description
`ShimName` AnsiString
`ModuleName` AnsiString
`ApiName` AnsiString
`Info` AnsiString

Event ID 32764: Message.

Channel: Compatibility-Infrastructure-Debug

Description

Message: Message

Message #

Message: %1

Fields #

Name	Description
`Message` AnsiString

Event ID 32765: Chain: Chain, Process: Process, Type: Type.

Channel: Trace
Also via: realtime ETW trace
Level: Informational

Message #

Chain: %1, Process: %2, Type: %3
Component: %4
Message: %5

Fields #

Name	Description
`ChainID` UInt32
`ProcessID` UInt32
`Type` AnsiString
`Component` AnsiString
`Message` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Application-Experience",
    "guid": "{EEF54E71-0661-422D-9A98-82FD4940B820}",
    "event_source_name": "",
    "event_id": 32765,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x2000000000000000",
    "time_created": "2026-06-02T05:07:42.964+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5CD02377-E707-4E90-899C-B6D5216D3A93}"
    },
    "execution": {
      "process_id": 1096,
      "thread_id": 19580
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ChainID": 0,
    "Component": "External",
    "Message": "Ignoring,Chain not found",
    "ProcessID": 4136,
    "Type": "TRACE"
  },
  "message": ""
}

Event ID 32766: Message.

Channel: Analytic

Description

Message: Message

Message #

Message: %1

Fields #

Name	Description
`Message` AnsiString

Event ID 32767: Message.

Channel: Compatibility-Infrastructure-Debug

Description

Message: Message

Message #

Message: %1

Fields #

Name	Description
`Message` AnsiString

Provenance

ETW provider GUID {EEF54E71-0661-422D-9A98-82FD4940B820}

Defined in aeevts.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB